Code injection in Lenovo Smart Camera X3, X5, and C2E firmware
Priority LOW 30CWE-94Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262.
Why it matters now
EPSS 0.00307 23rd percentileScored 2026-11-07
Fix Fixed Smart Camera X3, X5, and C2E firmware (Lenovo): 01.03.29.16
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Smart Camera X3, X5, and C2E firmware | before 01.03.29.16 | 01.03.29.16 | Patch available | CNA |
- Smart Camera X3, X5, and C2E firmware VendorLenovo Affected before 01.03.29.16 Fixed in 01.03.29.16 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:* | before 01.03.29.16 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:* | before 01.03.29.16 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:* | before 01.03.29.16 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:* Versions before 01.03.29.16 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:* Versions before 01.03.29.16 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:* Versions before 01.03.29.16 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
- Fix · CNA Smart Camera X3, X5, and C2E firmware (Lenovo) Fixed in 01.03.29.16
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Lenovo Smart Camera X3, X5, and C2E firmware 01.03.29.16
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2021-02562 Improper authorization in Lenovo Smart Camera X3, X5, and C2E firmwarePriority MEDIUM 44
- TI-2021-02563 OS command injection in Lenovo Smart Camera X3, X5, and C2E firmwarePriority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3615
- 2026-10-03 Alias added: GHSA-7p74-527p-2hvx
References
More Lenovo Smart Camera C2e Firmware vulnerabilities
- TI-2021-02562 Improper authorization in Lenovo Smart Camera X3, X5, and C2E firmware CVSS 3.1CRITICAL 9.8
- TI-2021-02563 OS command injection in Lenovo Smart Camera X3, X5, and C2E firmware CVSS 3.1HIGH 7.2
Sources
- CVE-2021-3615 · CVE Program
- CVE-2021-3615 · NVD
- FIRST EPSS
- GHSA-7p74-527p-2hvx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences